Export limit exceeded: 419342 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (419342 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-41022 | 1 Eaton | 1 Easysoft | 2026-11-04 | 5.9 Medium |
| Eaton easySoft improperly validates TLS certificates presented by easyE4 devices. A network-adjacent attacker could exploit this weakness to perform a man-in-the-middle attack and potentially intercept or modify communications between easySoft and easyE4. | ||||
| CVE-2026-41021 | 1 Eaton | 1 Easye4 | 2026-11-04 | 7.5 High |
| Eaton easyE4 uses an insufficiently strong password policy. An attacker who obtains a password hash, including through CVE-2026-41020, could perform an offline password-guessing attack and potentially recover user credentials. | ||||
| CVE-2026-41020 | 1 Eaton | 1 Easye4 | 2026-11-04 | 7.5 High |
| Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to captured authentication traffic to replay a valid authentication exchange and gain unauthorized access to the device. | ||||
| CVE-2026-122008 | 1 Oqtane | 1 Oqtane Framework | 2026-11-04 | 5 Medium |
| Oqtane Framework before 10.3.0 contains a server-side request forgery vulnerability in the UploadFile endpoint of FileController.cs that allows authenticated registered users to make the server fetch arbitrary URLs by supplying a caller-controlled url parameter to HttpClient.GetStreamAsync without validating the scheme, host, or IP address. Attackers can request internal resources such as cloud instance metadata services or localhost-bound management interfaces, save the fetched response as a file in their own user folder, and retrieve it via the download endpoint to exfiltrate sensitive internal data or enumerate internal network hosts and ports. | ||||
| CVE-2026-122006 | 1 Rubyonrails | 1 Active Storage | 2026-11-04 | 9.8 Critical |
| The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block unintended functionality. | ||||
| CVE-2026-121941 | 2026-11-04 | 7.8 High | ||
| libmt32emu before 2.8.4 contains a heap buffer overflow vulnerability in MidiStreamParserImpl::parseSysex that allows attackers to write past a heap allocation by supplying oversized unterminated SysEx messages. Attackers can feed more than 32768 SysEx data bytes through the mt32emu_parse_stream API via MIDI files, ports, or sequencer clients to corrupt heap memory and crash the application. | ||||
| CVE-2026-121255 | 1 Google | 1 Chrome | 2026-11-04 | 6.5 Medium |
| Incorrect authorization in Autofill AI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-121252 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-121251 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Missing authorization in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-121244 | 1 Google | 1 Chrome | 2026-11-04 | 5.4 Medium |
| UI misrepresentation in FileAPI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-121236 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Improper input validation in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-121222 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Incorrect authorization in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-121216 | 1 Google | 1 Chrome | 2026-11-04 | 5.4 Medium |
| UI misrepresentation in UI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-121215 | 1 Google | 1 Chrome | 2026-11-04 | 5.4 Medium |
| UI misrepresentation in Bluetooth in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-121213 | 1 Google | 1 Chrome | 2026-11-04 | 6.5 Medium |
| Uninitialized resource in Images in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-121212 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-121206 | 1 Google | 1 Chrome | 2026-11-04 | 5.4 Medium |
| UI misrepresentation in Isolated in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-121205 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Incorrect authorization in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-121204 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-121198 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Confused deputy in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) | ||||